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Foreword 



Not so long ago, our lives were mostly 
recorded on paper. From the doctor's 
office to the supermarket, any record of 
where we had gone or what we had done could 
only be tracked by looking at paper and ink. 
Today, however, the most intimate details of 
our personal habits and behaviors are now 
computerized. On millions of hard drives and 
microchips, more and more of what we do 
every day is recorded - not only by the govern- 
ment, but also by corporations. And as this 
report shows, when it comes to preserving our 
privacy, that is increasingly a distinction with- 
out a difference. 

This special ACLU report, the 12th in our 
series on civil liberties since 9/11, paints a 
sobering picture of just how little control we 
have over our information today. It shows how 
information-age technology, anemic privacy 
laws and soaring profits have all combined to 
endanger our privacy rights to a point never 
before seen in our history. 



After you read this report, you will see that 
reform is clearly needed. 

Americans from across the political spectrum 
understand that "the right to be left alone" is 
central to our constitutional democracy - that a 
secure sense of personal privacy is vital to pre- 
serving the openness of American life, and to 
protecting the boundless creativity, innovation 
and prosperity for which we are known around 
the world. 

If we allow the fear of terrorism to create a new 
industrial base for surveillance technology, 
unfettered by reasonable and effective privacy 
constraints, these special characteristics of the 
American way of life will wither on the vine. 

This report is packed with fascinating and fright- 
ening details about how the relationship between 
government and big business is changing before 
our eyes - or, all too often, behind our backs. 
Brought together, these details add up to a trend 
that would be almost hard to believe if it were 
not so well documented. 

We at the ACLU are not sitting passively as the 
growth of a "surveillance-industrial complex" 
continues. I hope that you will read this report, 
and then join us to help stop it. 

ANTHONY D. ROMERO 

Executive Director 

American Civil Liberties Union 
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Introduction 



Acting under the broad mandate of the 
"war" on terrorism, the U.S. security 
establishment is making a systematic 
effort to extend its surveillance capacity by 
pressing the private sector into service to report 
on the activities of Americans. These efforts, 
which are often costly to private businesses, 
run the gamut from old-fashioned efforts to 
recruit individuals as eyes and ears for the 
authorities, to the construction of vast comput- 
erized networks that automatically feed the 
government a steady stream of information 
about our activities. 

Public-private surveillance is not new. During 
the Cold War, for example, the major telegraph 
companies - Western Union, RCA and ITT - 
agreed to provide the federal government with 
copies of all cables sent to or from the United 
States every day - even though they knew it 
was illegal. The program, codenamed 
"Operation Shamrock," continued for decades, 
coming to an end only with the intelligence 
scandals of the 1970s. 

But even such flagrant abuses as Operation 
Shamrock pale in comparison to the emergence 



of an information-age "surveillance-industrial 
complex." The ongoing revolution in com- 
munications, computers, databases, cameras 
and sensors means that the technological 
obstacles to the creation of a truly nightmarish 
"surveillance society" have now been over- 
come. And even as this dangerous new poten- 
tial emerges, our legal and constitutional pro- 
tections against such intrusion have been 
eroded to a frightening degree in recent years 
through various court rulings as well as laws 
like the Patriot Act. 

The ACLU has documented the confluence of 
these two trends in a separate report. 1 But 
there is a third crucial obstacle that the 
American security establishment is seeking to 
overcome in its drive to access ever more 
information about ever more people. That 
obstacle is the practical limits on the 
resources, personnel and organization needed 
to extend the government's surveillance power 
to cover hundreds of millions of people. There 
will always be limits to the number of person- 
nel that the U.S. security state can directly 
hire, and to the "ratio of watchers to watched." 
This is the obstacle that the U.S. security 
establishment seeks to overcome by enlisting 
individuals and corporations as auxiliary 
members of its surveillance networks. 
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The advantages of privatized 
surveillance 

Besides allowing the government to overcome 
the practical limits on its resources (what political 
scientists call "state administrative capacity"), 
the technique of folding private individuals 
and organizations into a government's 
surveillance network has several advantages 
for the government: 

• It gives the government access to private- 
sector databases. Most of the interactions 
and transactions in Americans' lives are 
not conducted with the government, but 
with corporations and other private enti- 
ties, who therefore hold most of the details 
of Americans' lives - including much of 
what is private and important to them. 

• It lets the government create a system of 
"distributed surveillance" or "swarm 
intelligence" in which scattered, individ- 
ual, independent sources of information 
are brought together to create a big pic- 
ture that the government could never con- 
struct directly. 

• It shifts costs from government to the pri- 
vate sector by forcing companies to take 
expensive steps such as hiring additional staff 
to meet information collection and analysis 
mandates - in effect, imposing a hidden 
"surveillance tax" on those companies. 

• It creates constant uncertainty whenever 
people are in a situation where an inform- 
ant might be present, enormously amplify- 
ing the effect of government surveillance 
on individual behavior and psychology. 

• It offers what is often a path of least resist- 
ance to working around privacy laws. Our 
laws have historically protected information 



held by an individual, while information 
held by third parties was either assumed to 
be innocuous or protected by professional 
codes of confidentiality. But today, third- 
party information has become far more 
comprehensive and significant. 

• It allows the government to carry out pri- 
vacy-invading practices at "arm's length" 
by piggy-backing on or actually cultivat- 
ing data collection in the private sector 
that it could not carry out itself without 
serious legal or political repercussions. 

The privatization of government 
functions has always been a popular way 
of doing business in the United States, 
and surveillance is no exception. 



In this report, we look at many aspects of this 
trend - drawing together and setting in context 
many stories that in isolation might seem far 
less significant. The elements we examine are: 

• Recruitment and exhortation of individuals to 
serve as eyes and ears for the authorities. 

• Government recruitment of corporations and 
other private-sector organizations by forcing 
them either to turn over their customer data- 
bases, gather and store information in ways 
useful to the government or join regularized 
systems for reporting on individuals. 

• Growing government partnerships with pri- 
vate-sector companies that specialize in 
building dossiers about individuals. 

• Lobbying by companies in favor of increased 
surveillance. 

The privatization of government functions has 
always been a popular way of doing business in 
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the United States, and surveillance has been no 
exception. There is a long history of cooperation 
between government security agencies and pri- 
vate-sector surveillance programs, from private 
"detective" agencies like the Pinkertons, which 
helped employers battle the labor movement in 
the 19th century, to the "corporate officials, labor 
spies, super-patriots, amateur detectives and 
assorted vigilantes" who worked with the gov- 
ernment to combat radicalism after World War I 
and remained active in various forms right 
through the last years of the Cold War. 2 

But nothing in our past compares to the 
efforts at distributed mass-surveillance that 
are now underway, which combine the long- 
standing police impulse to expand private- 
sector information sources with awesome 
new technological capabilities for vacuuming 
up, storing and keeping track of vast oceans 
of information. 



Recruiting Individuals 



Homeland security starts at home. 
- U.S. Citizen Corps 

In January 2002 the Justice Department 
announced the creation of a program called 
the "Terrorism Information and Prevention 
System," or TIPS. Billed as "A national sys- 
tem for concerned workers to report suspi- 
cious activity," the program would have 
recruited "millions of American truckers, let- 
ter carriers, train conductors, ship captains, 
utility employees and others" as government 
informants. 3 The proposed scope of this proj- 
ect was stunning - it would have recruited, in 
its pilot program alone, one million inform- 
ants in just 10 cities - or one in every 24 
Americans living in those cities. 4 Many of 
those targeted for inclusion in the scheme 
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were workers with access to Americans' 
homes - utility workers, letter carriers and 
cable technicians - who were to report to the 
government anything that they considered an 
"unusual or suspicious activity." 

The recruitment of informants for particular 
investigations has long been a key tool of law 
enforcement, but only under the most oppres- 

A massive effort is underway to turn 
regutar Americans into untrained 
government monitors. 

sive governments have informants ever become 
a widespread, central feature of life. The East 
German Stasi, for example, not only employed 
91,000 full-time workers, but also recruited 
from among the citizenry more than 170,000 
non-professional informants, or as many as one 
in every 50 citizens, to spy and report on their 
fellow citizens. Stasi agents even used black- 
mail and other pressure tactics to get people to 
spy on their own family members. The result 
was to create a pervasive sense of mistrust that 
prevented citizens from sharing their complaints 
with each other, gaining strength from connect- 
ing with others of like mind and challenging 
those who were in power. 

Few believe that the U.S. will ever become a 
state like East Germany. But the TIPS propos- 
al was rightly met by a storm of outrage, and 
the government quickly moved to eliminate the 
inclusion of workers who visit Americans' 
homes. Even in its reduced form, however, 
Congress shut it down. 

But while TIPS proved short-lived, it was only 
the most blatantly offensive and direct example 
of an idea - organizing private individuals to 
increase the government's surveillance capacity 
- that continues to live on. A massive effort is 
underway to turn regular Americans into 
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untrained government monitors who, pressed by 
constant urgings for vigilance and suspicion and 
lacking the training or accountability of profes- 
sional law enforcement officers, are asked to 
report to the authorities anything they think is 
"unusual or suspicious." 

Some directives emanating from the govern- 
ment are undoubtedly beneficial, such as 
instructions on how to prepare for civil emer- 
gencies, and certainly there is nothing wrong 

Many "suspicious behaviors" cited by the 
authorities have no rational or proven 
relationship to terrorism. 

with the authorities making rational requests 
for citizens' help. But the new warnings are 
enormously vague and broad, yet frightening 
and intense. Unlike "wanted" posters and 
other traditional public appeals, they are based 
not on crimes that have already been commit- 
ted, but on the prospect or suspicion that an 
individual might be planning something bad. 
Many "suspicious behaviors" cited by the 
authorities have no rational or proven relation- 
ship to terrorism - and in fact, it is doubtful that 
there are such things as clearly defined behav- 
ioral predictors of terrorism. 

These kinds of broad directives leave a much 
wider scope for racial profiling and paranoia 
directed at anyone who is different or stands out 
- and are likely to generate large numbers of 
false positives that will swamp any useful infor- 
mation that might be obtained. In addition, none 
of these programs can be viewed apart from the 
larger context: a world where government has 
interrogated, fingerprinted and detained thou- 
sands of people based on their ethnicity. 

The government's constant exhortations to 
micro-vigilance, if taken to heart, will create an 
atmosphere of conformism and mistrust that 



encourages abuses, divides Americans from one 
another and casts a chill over the traditionally 
freewheeling nature of American life. 

"Watch" programs 

When President Bush called for the creation of 
TIPS in his 2002 State of the Union address, it 
was just one element of a larger program called 
the "Citizen Corps" that is aimed at giving 
Americans a chance to get directly involved in 
homeland defense. Bush also called for 
"Neighborhood Watch" programs to be dou- 
bled in number and expanded beyond their tra- 
ditional role of deterring and detecting house- 
hold burglary to "make them more attuned to 
preventing terrorism." 5 The means for carrying 
this out is a push to encourage the formation of 
"Citizen Corps Councils" around the nation. 
Citizen Corps materials urge Neighborhood 
Watch participants to "train family members on 
identifying suspicious behaviors that could 
indicate terrorist activity." 6 

The Citizen Corps home page still proclaims 
that its mission is to "harness the power of 
every individual through education, training 

"Be our eyes and ears so we can calm 
your fears. " 

- River Watch slogan 

and volunteer service to make communities 
safer, stronger and better prepared" for terror- 
ism and other threats. 7 And indeed, though 
Congress may have ordered TIPS shut down, 
the government continues to run several pro- 
grams that are very close in nature to TIPS. 

• Marine Watch programs. A Maine program 
dubbed "Coastal Beacon," recruits fishermen 
and members of the general public to keep a 
watch out for "suspicious activity." 8 The fact 



that this program does exactly what Congress 
banned under TIPS was confirmed by 
President Bush himself, who declared Coastal 
Beacon "one of the most innovative TIP [sic] 
programs in the country." 9 An Ohio program 
called "Eyes on the Water" urges boaters to 
report "unusual behavior when you see it." 
As one Coast Guard officer told a reporter, "A 
guy who is not wearing the right gear or fish- 
ing in an unusual location - let us know about 
it." A program in Michigan called "Paver 
Watch" has as its slogan, "Be our eyes and 
ears so we can calm your fears." 10 

• Highway Watch. Another TIPS program 
that has outlived TIPS is "Highway 
Watch," under which truck drivers are 
taught to recognize "highway dangers" and 
report them to a central dispatch center. 
The program has a heavy homeland securi- 
ty element - indeed, it is being funded by 
the Department of Homeland Security 
(DHS). A program fact sheet boasts that 
the more than three million truck drivers on 
the roads make up "a potential army of 
eyes and ears to monitor for security 
threats." Not only are drivers "naturally 
very aware of suspicious activity and 
behavior," but "truck drivers are every- 
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where - ports, airports, malls, bridges, tun- 
nels - thus giving greater range to home- 
land security observation efforts." 11 

• "CAT Eyes." A program called 
"Community Anti-Terrorism Training 
Institute," or "CAT Eyes," is working to 
"educate citizens in the civilian community 
to be effective eyes and ears for potential 
terrorist activities." Embraced by police 
departments from across the eastern U.S., it 
aims for the formation of hierarchically 
structured "neighborhood block watches" 
including "Neighborhood Coordinators," 
"Block Captains" and "Block Watchers," 
each of whom "acts as eyes and ears for law 
enforcement and reports any suspicious 
activity." The program's motto is "watching 
America with pride not prejudice." 12 

• Real Estate Watch. Police outside 
Cincinnati have set up a pilot program in 
which the police train real estate agents 
"how to be observant." The realtors keep 
their eyes open for suspicious activity as 
they make their rounds, based in part on 
alerts provided by the police, and report 
back anything suspicious they see. 13 

• Florida's TIPS. In a direct local imitation 
of the original TIPS concept, police in 
Orange County, Florida are planning to 
train emergency personnel, cable workers 
and other public and private workers to look 
for and report evidence of terrorism, drug 
trafficking, or child pornography in private 
homes. Overseen by Florida state police 
officials, the program's brochure originally 
included an element of explicit racial profiling. 
Though that was removed, the program is 
still underway, leaving homeowners to 
wonder if anything in their home might 
draw suspicion whenever a cable or utility 
worker comes in to do a repair. 14 
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• Other State Reporting Programs. Many 
states and localities appear to have citizen 
reporting programs in place. New York, 
for example, has instituted a "Statewide 
Public Security Tips Hotline" the public 
can use to report "suspicious or unusual 
behavior" to the police. "In protecting our 
homeland security," declared a September 
2002 news release on the program, "the 
public should consider themselves part- 
ners with our local, state and federal law 
enforcement agencies." All tips, however 
raw, "will be cross-referenced through 

Privacy safeguards are rarety created by 
security agencies on their own without 
intense outside pressure. 

federal, state and local databases." There 
is no mention of whether the name of an 
innocent person who is the subject of a tip 
will ever be purged from the record. 15 

In fact, it is far from clear what any of these pro- 
grams do with information about "suspicious" 
individuals that they receive - how reports are 
recorded, shared and stored in domestic intelli- 
gence or law enforcement databases or what is 
done to ensure that innocent individuals who are 
the subjects of raw suspicions and rumors will 
not have a permanent black mark associated with 
their names in some government database. 
Experience has shown that such safeguards are 
rarely created by security agencies on their own 
without intense outside pressure. 

A disturbing sub-genre of TIPS-like programs 
are those run by the military. They include: 

• "Eagle Eyes." This program is billed as "an 
anti-terrorism initiative that enlists the eyes 
and ears of Air Force members and citizens 
in the war on terror." In addition to a tele- 
phone tip line, the program offers training in 



how to detect terrorist activity. "Anyone 
can recognize elements of potential terror 
planning when they see it," boasts the pro- 
gram's Web page. Things to watch for 
include "People who don't seem to belong 
in the workplace, neighborhood, business 
establishment or anywhere else. ... If a per- 
son just doesn't seem like he or she belongs, 
there's probably a reason for that." 16 

• "Talon." According to an internal memo 
obtained by Wired News, this Pentagon data- 
base contains "raw, non-validated" reports of 
"anomalous activities" within the United States, 
and provides a mechanism to collect and share 
reports "by concerned citizens and military 
members regarding suspicious incidents." 17 

The Pentagon says the purpose of the Talon sys- 
tem is to protect Defense Department property 
and personnel. Of course, since a terrorist could 
try to attack those targets just like any others in 
the U.S., there is no limit to the amount of 
domestic surveillance that could be justified by 
that rationale. Interestingly, the same rationale of 
"base protection" was given when it was discov- 
ered that the Army was involved in the construc- 
tion of dossiers about millions of U.S. airline 

A disturbing sub-genre of TIPS-like 
programs are those run by the military. 

passengers (see p. 10). All this in a context 
where, as one expert puts it, the military is acting 
to "break down long-established barriers to mili- 
tary action and surveillance within the U.S." 18 

Citizen vigilance 

Beyond these organized watch programs 
are more diffuse campaigns of "citizen 
awareness" featured on government Web 
sites around the nation. These campaigns 
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urge Americans to be suspicious, and to 
report to the authorities anyone who fits a 
long list of suspicious characteristics. 
State and local governments have posted or 
linked to reams of materials that one way 
or another warn and instruct citizens "how 
to be vigilant." 19 

Examples of this kind of material abound: 

• A flyer from the Maryland State Police 
asks citizens to be alert for "anyone who 
does not appear to belong." 20 

• The residents of Lucas County, Ohio, and 
many other localities around the country 
are admonished in materials prepared by 
the DHS to look for "persons not fitting 
into the surrounding environment," 
including any "beggar, demonstrator, 
shoe shiner, fruit or food vendor, street 

Predictably, the tip centers that have 
been set up are already attracting 
malicious tips. 

sweeper, or a newspaper or flower vendor 
not previously recognized in the area," 
who, it is explained, could be a terrorist 
in disguise. 21 

• Messages on electronic highway signs in 
Virginia and Maryland list toll-free phone 
numbers and ask drivers to "Report Info 
on Terrorism" and "Report Suspicious 
Activity" - solicitations that leave many 
citizens puzzled over just how they are 
supposed to act on them. 22 

• A widely distributed version of DHS's 
color-coded terrorism "Homeland 
Security Advisory System" tells citizens 
to be "watchful for suspicious activities." 23 
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A significant 
example of citi- 
zen "lookout lit- 
erature" is a 
"Citizens' 
Preparedness 
Guide" published 
by the federal 
Citizen Corps. 
After an intro- 
duction in which 
Attorney General 
John Ashcroft declares that "your 
country has never needed you more," 
the guide urges Americans to "be alert 
as you go about your daily business" 
and "learn the normal routines" in 
order to "help you to spot anything out 
of place." Citizens should be "on the 
lookout" for suspicious activities "in 
your neighborhood, in your workplace, 
or while traveling" - in short, every- 
where. When it comes to the Internet, 
famous for being home to every imagi- 
nable activity, viewpoint, hobby and 
fetish, Americans are told to "report 
unusual activities to the authorities." 

In addition to directing Americans to 
"keep your yard clean" and "prune 
shrubbery," the guide asks citizens to 
contact the FBI "immediately" if they 
"observe a pattern of suspicious activi- 
ty," including "someone unfamiliar to 
you loitering in a parking lot." 

Concludes the guide, "Homeland secu- 
rity starts at home." 24 
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Recruiting Companies 



• A Coast Guard Web site lists "suspicious 
activity" that includes the distribution of 
"Anti-American pamphlets, or flyers" 25 - 
certainly an invitation to abuse, considering 
how broadly the label "Anti- American" has 
been applied in the past. (In addition, it is 
unlikely that a genuine terrorist planning an 
attack would call attention to himself by 
leafleting beforehand.) 

Implicit racial profiling 

Predictably, the tip centers that have been set up 
are already attracting malicious tips from individ- 
uals "turning in" neighbors they dislike, tips 
about strangers engaging in "un-American activ- 
ity" and of course many reports based on racial 
profiling. "We've gotten calls from people 
who've seen someone who looks Middle Eastern 



The government is increasingly 
circumventing those restrictions 
simply by turning to private companies. 



We regret to inform you that we have decided 
that it is not in our best interest to continue 
your banking relationship with us. 
-Letter from Fleet Bank to U.S. 
citizen Hossam Algabri 

As disturbing as the government-sponsored 
informer programs are, even more alarming is the 
government's recruitment of companies and other 
independent organizations into its growing sur- 
veillance machinery. The Privacy Act of 1974, 
although riddled with exceptions and loopholes, 
does restrict the ability of law enforcement agen- 
cies to maintain dossiers on individuals who are 
not suspected of involvement in wrongdoing. 27 
But the government is increasingly circumvent- 
ing those restrictions simply by turning to private 
companies, which are not subject to the law, and 
buying or compelling the transfer of private data 
that it could not collect itself. 

A long history of private- 
sector surveillance 

The U.S. government actually has a long histo- 
ry of turning to the private sector for help in 
gathering information on individuals. 
Examples include: 

• The Western Goals Foundation. In Los 

Angeles, thousands of files on activists of all 
kinds were ordered destroyed in the wake of 
the revelations of domestic spying in the 
1970s. But in 1983 these raw intelligence 
files were discovered hidden away in the 
garage of an LAPD detective, who had been 
sharing them with the Western Goals 
Foundation, a Cold War anti-communist 
group that used the files to build private 
dossiers on progressive political activists 
around the nation. Western Goals acted as a 



in the store or library, maybe on the computer," a 
Virginia police official told the Chicago Tribune. 16 

In fact, the generality of many of these warn- 
ings and reminders may be explained by an 
implicit element of racial profiling. Does the 
Coast Guard really want to receive reports on 
every "guy who is not wearing the right gear 
or fishing in an unusual location"? Or just 
when that "guy" happens to be of Middle 
Eastern appearance? 

Truckers anxiously watching the highways, 
boat owners watching the shores, individuals 
constantly urged to watch for people who don't 
fit in - together it adds up to a vision very close 
to what was envisioned under the supposedly 
discontinued TIPS program. 
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private "clearinghouse" of dossiers on polit- 
ical activists from police agencies in differ- 
ent states - collecting, disseminating and 
"laundering" the sources of that informa- 
tion. 28 The group circulated information - 
much of it false and defamatory - about 
those activists not only to local police depart- 
ments, but also to numerous federal police 
agencies including the Secret Service, the 
FBI, the State Department and the CIA. 29 

• The "San Diego Research Library." In 

another case, a retired military intelligence 
officer named Ralph H. van Deman estab- 
lished a legendary data collection facility in 
California, which kept dossiers on religious, 
labor, civil rights and other activists. For over 
30 years beginning in 1929, this "private" 
facility, operated with the support of private 
donors, the state of California and the Army, 
maintained 200,000 files based in part on 
confidential information provided by volun- 
teer informers. The facility regularly 
exchanged material with federal and state 
intelligence agencies, and thus served as a 
quasi-governmental intelligence agency. 30 

• Operation Shamrock. Perhaps the ulti- 
mate example was the Cold War program 
called "Operation Shamrock," in which 
the major U.S. telegraph companies 
"secretly turned over to the NSA, every 
day, copies of all messages sent to or from 
the United States." 31 As described by 
reporter and author James Bamford, the 
program began in 1945 when the presi- 
dents of the telegraph companies all 
agreed to participate after the government 
appealed to their patriotism. They took 
part knowing that their actions were ille- 
gal and against the uniform recommenda- 
tions of their own corporate attorneys. 32 
When the carriers computerized their 
operations in the 1960s, Operation 
Shamrock gained the ability to conduct 



keyword searches through each day's traf- 
fic. At that point, the NSA increasingly 
began to scan the nation's telegraphs 
against long lists of surveillance targets 
provided to the NSA by other security 
agencies - including American anti-war 
and civil rights protesters, and even such 
groups as the Quakers. 33 

The potential is greater today 

But even abuses like Operation Shamrock 
pale in comparison to what is possible with 
today's technology: 

• Computer hardware and software is far 
more sophisticated. Unwieldy tape reels 
have been replaced by swift and massive 
hard drives, and software today can, with 
increasing reliability, transcribe spoken 
words or analyze meaning based on the 
context of a communication. 

• More business is conducted electronical- 
ly. Because of the convenience of cell 
phones, the Internet and other innovations, 
the amount of business that Americans 
conduct via electronic communication has 
vastly increased. 

The threat posed by government 
collection of third-party information is far 
greater today than it would have been in 
the 1950s, or even the early 1990s. 



• Corporations are gathering more data 
for their own reasons. Companies have 
discovered that information about cus- 
tomers has enormous cash value - and 
now have on hand cheap new technolo- 
gies for collecting, storing and sharing 
such data. Americans are increasingly 
finding themselves pestered for personal 
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details at every turn, or routinely tracked 
through stratagems like supermarket loy- 
alty cards - all for the purpose of building 
a financially valuable record of their 
lifestyle and habits. 34 



To obtain information about individuals' 
activities, the government often need do 
no more than ask. 



Corporate compliance with government data- 
surveillance efforts ranges from unwilling 
resistance to indifferent cooperation to eager 
participation to actual lobbying of the govern- 
ment to increase such activities. But with a 
range of options at its disposal, the government 
can acquire a rich stream of information about 
private activities from any source. These tech- 
niques add up to a startling advance in govern- 
ment monitoring of American life. Let us 
examine each of them. 



The result of these developments is that the 
threat posed by the systematic government col- 
lection of personal information held by corpo- 
rations and other third parties is far greater 
today than it would have been in the 1950s, or 
even the early 1990s. 

Many options for accessing private data 

The bottom line is that the private sector is 
tracking more and more of our activities for its 
own purposes, and the government is free to 
leverage this private collection as a way of 
extending its own powers of surveillance. The 
government has an array of options for access- 
ing third-party information. It can: 

• Ask for data to be shared voluntarily. 

• Simply buy information. 

• Demand it, using legal powers granted by 
the Patriot Act and other laws. 

• Use laws and regulations to dictate how 
private-sector data is handled and stored in 
order to increase its surveillance value for 
the government. 

• Create regularized systems for standing 
access to records of private activities. 



Companies may be afraid to turn down 
"voluntary" requests because they fear 
regulatory or law enforcement scrutiny 
of their own activities. 



Voluntary sharing of data 

To obtain information about individuals' activ- 
ities, the government often need do no more 
than ask. Many companies are willing to hand 
over the details of their customers' purchases 
or activities based on a simple request from the 
FBI or other authorities. Some companies 
believe they are being patriotic; others may be 
afraid to turn down "voluntary" requests 
because they fear regulatory or law enforce- 
ment scrutiny of their own activities; others 
may simply be eager to please. 

Multiple airlines have admitted turning over 
the records of their customers' travels to the 
government. In each case, the information was 
turned over not to help the government solve a 
particular crime or track a particular suspect, 
but in order to examine each traveler's records 
in the hopes of identifying terrorists by detect- 
ing "suspicious" patterns in his or her travels - 
in effect, turning every traveler into a suspect 
(see discussion of data mining, p. 23). 
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percent had provided customer or employee 
data to the government, many of them in vio- 
lation of their own privacy policies. 41 

These are only some of the examples that have 
come to light; as the airline examples indicate, 
companies that have shared information are 
often far from open about it. 



• At the request of an official now at DHS, 
the airline JetBlue gave a Pentagon sub- 
contractor more than 5 million passenger 
records, which were combined with 
detailed personal files on each passenger 
purchased from a "data aggregator" com- 
pany called Acxiom. 35 

• When the JetBlue story broke, Northwest 
Airlines said it had not shared its passen- 
gers' records, but a few months later it was 
discovered that in fact, it had given mil- 
lions of passenger records to NASA. 36 

• In April 2004, American Airlines admitted 
that it, too, had shared passenger records 
(1.2 million of them) with the TSA and 
four research companies. 37 

• In May 2004 the nation's largest airlines, 
including American, United and 
Northwest, also admitted giving millions 
of passenger records - up to a year's worth 
- to the FBI after the 9/11 attacks. 38 

Other known recent examples of "voluntary" 
data sharing with the government include: 

• Scuba shops. In May 2002 the Professional 
Association of Diving Instructors voluntarily 
provided the FBI with a disk containing the 
names, addresses and other personal infor- 
mation of about 2 million people, nearly 
every U.S. citizen who had learned to scuba 
dive in the previous three years. 39 

• Colleges and universities. A 200 1 survey 
found that 195 colleges and universities 
had turned over private information on 
students to the FBI, often in apparent vio- 
lation of privacy laws; 172 of them did not 
even wait for a subpoena. 40 

• Travel companies. A 2001 survey of travel 
and transportation companies found that 64 



There is a long and unfortunate history 
of cooperation between government 
security agencies and powerful 
corporations to deprive individuals of 
their privacy and other civil liberties. 



InfraGard - a corporate TIPS program? 

A more systematic example of voluntary coop- 
eration is a partnership between the FBI and 
private corporations called "InfraGard." This 
program is aimed at encouraging "the 
exchange of information by the government 
and the private sector members" to protect 
against terrorism and other threats to the 
nation's infrastructure. 

The program has more than 10,000 members 
organized into 79 local chapters; the list of par- 
ticipating companies is kept secret. Members 
wishing to participate fully must undergo a 
security check and obtain clearance by the 
FBI. 42 The Cleveland Plain Dealer described it 
as a "a vast informal network of powerful 
friends," a "giant group of tipsters" created by 
the FBI under a "philosophy of quietly work- 
ing with corporate America" in order to "funnel 
security alerts away from the public eye and 
receive tips on possible illegal activity." 43 

It is not clear what kind of information sharing takes 
place under InfraGard. The program was created as 
a means of stopping cybercrime, but has broadened 
to cover threats of all kinds to the nation's "critical 
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infrastructure." The program's Web site suggests 
that it simply gives the FBI a quick way to spread 
specific, credible security alerts to companies that 
may be targets, and gives companies a discreet way 
to report attacks by hackers. 

But there is evidence that InfraGard may be 
closer to a corporate TIPS program, turning pri- 
vate-sector corporations - some of which may 
be in a position to observe the activities of mil- 
lions of individual customers - into surrogate 
eyes and ears for the FBI. For example, several 
program members told the Plain Dealer that 
"they received through InfraGard a list of Web 

The government has a powerful arsenal 
of legal weapons with which to force 
third parties to provide access to 
individuals' records. 

sites frequented by terrorists and were monitor- 
ing their computer networks to see if anyone on 
their systems visited those pages." 44 It is also 
possible that the program serves as a more con- 
trolled version of the FBI's watch list distribu- 
tion program "Project Lookout" (see p. 19). 

There is a long and unfortunate history of 
cooperation between government security 
agencies and powerful corporations to deprive 
individuals of their privacy and other civil lib- 
erties, and any program that institutionalizes 
close, secretive ties between such organiza- 
tions raises serious questions about the scope 
of its activities, now and in the future. 

Purchasing data on the 
open market 

Another option open to government agencies 
seeking information on individuals is to sim- 
ply purchase it on the open market. As pri- 
vate-sector information-gathering has 



exploded in recent years, so has the amount 
of data that is now available to the govern- 
ment (and any other customer) willing to pay 
the price. Although government informa- 
tion-purchasing was once a minor matter, the 
explosion of private-sector data collection 
has begun to significantly undermine the 
laws meant to protect Americans from gov- 
ernment snooping. 

Perhaps the ultimate example of the powerful 
information sources now available for pur- 
chase by the government is the existence of 
companies called data aggregators, which 
make it their business to gather, compile and 
distribute dossiers full of information about 
Americans' personal lives (see p. 25). 

Plentiful legal powers to demand 
private-sector data 

If a company won't donate or sell its data on 
individuals, the government has a powerful 
arsenal of legal weapons with which to force 
it (as well as other entities such as doctors' 
offices and libraries) to provide access to 
individuals' records in its possession. 45 
Even as private-sector companies hoard 
more and more details about our transac- 
tions, the government's powers to obtain 
that data are growing: 

• The Patriot Act. The Patriot Act makes it 
much easier for the government to demand 
information from businesses and lowers 
the standard of evidence required for such 
demands. Section 215 of the act, for 
example, gives the FBI the power to 
demand customer records from Internet 
service providers (ISPs) and other commu- 
nications providers, libraries, bookstores 
or any other business - with little judicial 
oversight. The businesses can be banned 
from telling anyone, including their affect- 
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ed customers, about the search. And the 
search orders do not even have to specify 
a particular target. 46 

• National Security Letters. These 
obscure devices, which can be written by 
FBI officials in field offices without the 
approval of a judge, give the government 
broad power to demand records. Once 
upon a time this sweeping power could 
only be used to get information about 
"agents of a foreign power" from banks, 
credit agencies and Internet service 
providers. But the Patriot Act changed the 
law to allow their use against anyone, 
including persons not suspected of a 
crime. 47 And a bill quietly signed into law 
by President Bush in December 2003 
extends coverage to a wide variety of busi- 

Law enforcement is increasingly 
forward-looking - trying not just to 
solve crimes but to anticipate and 
prevent them. 

nesses, ranging from jewelry stores to 
stockbrokers to car dealerships to casi- 
nos. 48 Businesses are also subject to a gag 
order prohibiting them from talking about 
the government's data demands. 

Most restrictions on the use of information in 
government databases have exceptions for law 
enforcement and intelligence purposes. The 
scope of those exceptions was once clear: It was 
limited to attempts to solve crimes, and to stop 
foreign espionage. But under the new, post-9/1 1 
security paradigm, which more than ever before 
views every American as a potential suspect, 
those exceptions may now be far wider than was 
ever intended when they were written into the 
law. Law enforcement is increasingly forward- 
looking - trying not just to solve crimes but to 
anticipate and prevent them. And the boundaries 



between foreign intelligence and domestic law 
enforcement have come under sustained assault. 49 

Already "fishing" with new powers 

The government's expanded surveillance 
powers are, in fact, being used. Phone com- 
panies, banks and retail stores report more 
requests by law enforcement for information 
about customers: 50 

• In December 2003, the FBI presented 
national security letters to hotels in Las 
Vegas and obtained access to names and per- 
sonal information on all their customers 
between December 22 and New Year's Day. 
The FBI also vacuumed up information on 
anyone who flew into the city, rented a car or 
truck or patronized a storage facility. The 
FBI thus indiscriminately scrutinized the 
lawful activities of an estimated 270,000 
Americans based on no individualized suspi- 
cion of wrongdoing. 51 (Ironically, the inci- 
dent came as the city was conducting an 
advertising campaign based on the slogan, 
"what happens here, stays here.") 

• Since passage of the Patriot Act, the FBI 
has been using national security letters 
very aggressively in general, according to 
a January 2003 list obtained through a 
Freedom of Information Act request filed 
by the ACLU. The list was blacked out - 
but it was six pages long. 52 

• Internet service providers report that 
search orders have "gone through the 
roof." 53 ISPs maintain records of individ- 
uals' Internet use, including records of IP 
addresses (a number that is assigned to 
each computer that connects to the 
Internet) that can be combined with logs 
automatically maintained by most Web 
servers to identify which individuals have 
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visited a Web site, participated in "anony- 
mous" chat or message boards or adopted 
a particular online pseudonym. In 2002 
alone, for example, BellSouth received 
about 16,000 subpoenas from law 
enforcement and 636 court orders for cus- 
tomer information. 54 

• Attorneys who represent many of the 
affected companies report that it is not just 
the number of requests that is increasing, 
but also their scope; more requests take a 
"shotgun approach" or are "just fishing." 55 

What happens to all of this data when the 
authorities complete the investigation for 
which it was collected? As one former high- 
ranking intelligence official observed, "The 
FBI doesn't throw anything away." 56 

In addition, private companies often do not 
have the time, resources or inclination to "min- 
imize" the data that they hand over to the gov- 
ernment. Instead of turning over just the 
names of its customers, for example, a hotel 
might find it easier to simply hand over its 
complete files, including all the details of cus- 
tomers' transactions. 

Building in surveillance 

In addition to requesting, purchasing or order- 
ing the supply of private-sector data, the gov- 
ernment is also taking steps to ensure that noth- 
ing is left to chance when it needs information 
from a particular company or industry. By 
affirmatively guiding, structuring or mandating 
the maintenance of information on individuals 



The government is taking steps to ensure 
that nothing is left to chance when it 
needs information from a particular 
company or industry. 



by private organizations, the government is 
ensuring that its agents will get what they want 
when they go looking for it. 

CALEA 

An early example of this trend is the 
Communications Assistance for Law 
Enforcement Act of 1994 (CALEA), which 
forced telecommunications providers to 
design their equipment according to the FBI's 
specifications in order to make eavesdropping 
easier and more convenient - in effect, requir- 
ing the architects of the nation's newest com- 
munications networks to twist those networks 
into designs that they would not otherwise 
take, simply to preserve the government's 
ability to eavesdrop. It is the constitutional 
equivalent of the government requiring that 
all new homes be built with a peephole for 
law enforcement to look through. 

Recently, the FBI and other law enforcement 
agencies have sought to expand CALEA even 
further. They have pushed for an aggressive 
interpretation of the statute that would allow it 
to monitor certain Internet content without a 
warrant, and to collect tracking information 
about the physical locations of cell phone users 
- turning cell phones into what, for all practical 
purposes, are location tracking bugs (a use that 
many, including the ACLU, assert is not 
authorized at all by CALEA). 

And now, the FBI is also trying to force broad- 
band Internet providers to build their technical 
systems in a way that will allow the government 
to eavesdrop on Internet telephone calls. 57 The 
fledgling Internet phone industry is still experi- 
menting with a variety of technologies, yet the 
government would force companies to give law 
enforcement a ground-floor veto over the spec- 
ifications of new products they develop - 
before they've even worked out the bugs or 
tested their success in the marketplace. 



Mandatory data retention 



Airline Profiling 
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Around the time that the FBI pushed for and 
won the surveillance-enabling CALEA 
statute, it also made a push for a national 
"data retention" law, which would have 
forced ISPs and other communications 
providers to retain their records of individu- 
als' communications for a set period of time 
just in case those records should prove helpful 
in an investigation. More recently, there were 
reports that an early draft of the Bush admin- 
istration's "National Strategy to Secure 
Cyberspace" called for a mandatory customer 
data retention regime. 58 

In a legal environment where the government 
has very few limits on its ability to access infor- 
mation about individuals that is stored by third 
parties such as ISPs, a data retention law requir- 
ing such storage would short-circuit one of the 
few true privacy protections left - the disposal 
of records once they are no longer needed. 

The U.S. has pushed the European Union to 
adopt data retention laws. In October 2001, for 
example, President Bush himself directly asked 
the EU to change its rules to allow for the reten- 
tion of communications traffic data. 59 It is being 
adopted by 9 of the 15 EU member states. 60 
This is a perfect example of what has been 
called "policy laundering" - the act of pushing 
laws through foreign and international bodies 
that could never win direct approval at home. 

Americans have long feared the specter of the 
government maintaining dossiers filled with 
information about the lives of individual, inno- 
cent citizens. Data retention, whether manda- 
tory or de facto, achieves the same goal indi- 
rectly, by ensuring that information is stored by 
corporations - from where, as we have seen, it 
can easily be accessed by the authorities. 



Another example of this dynamic can be found in 
airline profiling proposals such as the CAPPS II 
program, under which the government would con- 
duct background checks on every traveler in order 
to give him or her a "risk assessment" rating of 
"red," "yellow" or "green." CAPPS II would 
require the airlines to collect and furnish to the 

The U.S. has pushed the European Union 
to adopt data retention laws. 

government each passenger's full name, address, 
phone number and date of birth when they make a 
reservation. Computer systems in use today are 
not built to track - they are unable to tell if the John 
Doe who took one flight is the same Jonathan Doe 
who took another, and the same J.S. Doe Jr. who 
took a third. By imposing a standardized data-col- 
lection requirement, the government will make it 
easy to compile lifetime travel dossiers covering 
everyone who flies anywhere in the world. 61 

The Computer Reservation Systems - independ- 
ent contractors that handle reservations for almost 
all airlines - are under absolutely no legal obliga- 
tion to protect the privacy of that information. 
They do not have direct relationships with actual 
travelers, and thus have no consumer privacy pol- 
icy by which they must abide (or market pressure 
for good privacy practices). And no U.S. privacy 
laws restrict their ability to compile, store and 
share their dossiers on individuals' travel. 

And of course, there are plenty of laws that 
would give the DHS and other government agen- 
cies easy access to these travel dossiers - if the 
CRSs don't simply sell them access outright. 62 

In July 2004, Homeland Security Secretary Tom 
Ridge seemed to indicate that the CAPPS II program 
would be terminated. Other DHS officials, howev- 
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er, indicated that while the CAPPS name may be 
retired, the concept will live on. As one spokesper- 
son put it, "The process of creating an automated 
passenger pre-screening system. . . will continue." 63 

Whether through CAPPS II or some other passen- 
ger-profiling system, it is clear that the govern- 



Through the Patriot Act, the 
government has created a system for 
the near-total surveillance of the 
nation's financial system. 



The new focus on "terrorist financing 
activities" potentially involves much deeper 
scrutiny of everyday financial transactions 
than has been previously conducted. 



ing of financial activities, which has been 
enabled by the Patriot Act and justified by the 
need to stop money laundering. Through the 
Patriot Act, the government has created a sys- 
tem for the near-total surveillance of the 
nation's financial system: 

• It expanded a system for reporting "suspi- 
cious" financial transactions. 

• It set up a system for the government to con- 
duct broad-ranging, nationwide "Google 
searches" through financial records. 

• It required financial institutions to set up 
an identity verification process. 

• It required financial institutions to check their 
customers against government "watch lists." 

These steps involve the increased use of tools 
that were originally created to catch drug deal- 
ers and other traditional criminals in the fight 
against terrorism. But as a Federal Reserve 
official pointed out to Congress, 

Terrorist financing activities are unlike 
traditional money laundering in a very 
significant respect. Money used to 
finance terrorism does not always origi- 
nate from criminal sources. Rather, it 
may be money derived from legitimate 
sources that is then used to support 
crimes. Developing programs that will 
help identify such funds before they can 
be used for their horrific purposes is a 
daunting task. 64 

In short, the new focus on "terrorist financing 
activities" potentially involves much deeper 
scrutiny of everyday financial transactions than 
has been previously conducted, because it 
involves searches of "money derived from 
legitimate sources" and scrutiny of individuals 
who have not committed any crime. 



that provide constant feeds of (or open access to) 
private-sector data. Such systems truly turn pri- 
vate companies - in some cases, entire indus- 
tries - into agents of the surveillance state. 

A prime example of such a system is the 
growing machinery for government monitor- 



ment once again wants to make sure that personal 
data will be waiting in private hands (and in a suit- 
able form) when agents want it. 

The Patriot Act: Drafting 
industry into the government's 
surveillance net 

As we have seen, the government has many 
options for accessing particular pools of infor- 
mation. Other developments, however, are 
potentially even more frightening than the gov- 
ernment's free hand in gathering data on partic- 
ular targets. Increasingly, the government is 
working to construct systematic mechanisms 
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Expanded system for reporting 
"suspicious" financial transactions 

The nation's financial companies have been 
enlisted into an enormous effort to provide a 
steady stream of routine financial information 
to the government. Under the Bank Secrecy 
Act of 1970, every bank, thrift and credit union 

The nation's financial companies have 
been enlisted into an enormous effort to 
provide a steady stream of routine 
financial information to the government. 

is required to file a report with the government 
whenever a customer deposits $10,000 or 
more. The Patriot Act has dramatically 
expanded that requirement, stating that "any 
person who is engaged in a trade or business" 
- meaning every shop owner, plumber, con- 
sultant, home-improvement contractor and so 
on - who receives $10,000 or more in cash 
must file a detailed report, called a "Suspicious 
Activity Report," with the government. 65 

Among the problems with this system: 

• While $10,000 may seem like a lot of 
money, it's not as much as it used to be, 
and the law contains no provision indexing 
this reporting threshold to inflation. If, 
when this law was originally passed in 
1970, the threshold had been set at a level 
equivalent to $10,000 of today's spending 
power, it would be just $2,625 today. In 
effect, the threshold for reporting to the 
government has been lowered by nearly 75 
percent. And if this law had been passed 
at the corresponding level in 1932, the 
threshold today would be just $855. 66 

• Those affected the most may be immi- 
grants and minorities, who tend to use the 
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traditional banking system the least (and 
therefore, when making a large purchase, 
are less likely to be able to write a check). 

• Given the lack of privacy protections for 
credit card records, which are routinely 
shared by financial institutions, cash is the 
only recourse for those who want to preserve 
their privacy when making a purchase. 

• It's far from clear how effective this system 
will be at its stated goal of stopping money 
laundering. "You're trying to turn an untrained 
populace into the monitors of money laun- 
dering activity," according to financial regu- 
lation expert James Rockett. "If you want to 
stop this, it's got to be done with police work, 
not tracking consumers' buying habits." 67 

With all this information pouring into an 
enormous government database of financial 
transactions, the effect will be continuous 
government monitoring of an ever-growing 
proportion of individuals' economic activities. 

A system for government "Google 
searches" through Americans' private 
financial records 

Even more powerful than the "Suspicious 
Activity" reporting requirement is a set of gov- 
ernment regulations (stemming from Section 314 
of the Patriot Act) that force financial institutions 
to check their records to see if they have engaged 

Any arm of government with a law 
enforcement function can now order a 
search of financial institutions across the 
nation for records matching a suspect. 

in any transactions with "any individual, entity or 
organizations listed in a request submitted by" 
the government. This grants any arm of govern- 
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ment with a law enforcement function - includ- 
ing even agencies such as the Agriculture 
Department and the Postal Service - the power to 
order a search of financial institutions across the 
nation for records matching a suspect. 

These searches can be done to investigate any 
suspected cases of money laundering - an 
extremely broad offense that encompasses any 
effort to disguise illicit profits, and can be used 
in pursuit of more than 200 different crimes. 
According to figures obtained by Newsweek, in 
2003 alone the government used the Patriot Act 
to conduct searches on 962 suspects - and two 
thirds of the documents obtained were for 
money laundering cases that had no apparent 
connection to terrorism. 68 

Of course, the names of suspects that the gov- 
ernment runs by financial institutions can pre- 
sumably be retained by those financial institu- 
tions, and nothing prevents them from blacklist- 
ing those individuals and refusing to give them 
loans or otherwise do business with them, even if 
they are perfectly innocent of any wrongdoing. 69 

The unprecedented effect of these rules is to 
create and put at the government's fingertips an 
enormous distributed database of every trans- 
action recorded by a financial institution in the 
United States. 

New ID requirements 

Completing the circle of the government's sys- 
tematic enlistment of financial companies in its 
surveillance web is Section 326 of the Patriot Act, 
which requires that such companies create a 
"Customer Identification Program" of strict iden- 
tity checks. The law requires that when any cus- 
tomer opens an account, takes out a loan, obtains 
a credit card or performs any other financial busi- 
ness, the financial institution must obtain and ver- 
ify the customer's name, address, date of birth and 
social security number. Usually this is done by 



demanding a picture ID. Furthermore, the law 
imposes a data-retention requirement, mandating 
that companies keep records of identity verifica- 
tion for five years past the closure of an account. 70 

This provision protects and enhances the gov- 
ernment's other powers to search through 
financial records by seeking to ensure that 

The Patriot Act mandates that compa- 
nies transform themsetves into surro- 
gate agents for the government. 

those records can be consistently linked to all 
the other records that exist about an individual. 
Of course, like all ID-checking requirements, 
this is ultimately a futile measure against any 
even minimally motivated bad actor. 

Watch list checks 

Once financial institutions have verified a cus- 
tomer's identity, they face another significant 
requirement imposed by Section 326 of the 
Patriot Act: They must check whether the person 
is on a government list of known or suspected 
terrorists or other watch lists. This requirement 
goes beyond simply acquiring information from 
the private sector; it actually mandates that com- 
panies transform themselves into surrogate 
agents for the government, required to constant- 
ly watch for anyone listed on one of the govern- 
ment's lists of suspected terrorists. 

Individuals must now be checked against terror- 
ist watch lists whenever they buy or sell proper- 
ty - including jewelers, pawnbrokers, and even 
average families buying or selling a home. 71 

Watch list searches can and do cause real harm 
to people. For example: 

• An American citizen named Hossam 
Algabri received a statement in late 2002 
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from Fleet Bank discontinuing his 
account. The bank would not tell him 
what the problem was, except that he had 
been targeted for "suspicious activity." 72 
Algabri was just one of many people with 
similar experiences. 

• Under a program called "Project Lookout," 
the FBI circulated among corporations a list 
of hundreds of names of people whom it 
was seeking in connection with 9/11. The 
list, which was riddled with inaccuracies 
and contained the names of many people the 
Bureau simply wanted to talk to, was wide- 
ly shared and re-shared, and quickly took on 
a life of its own. Companies began check- 
ing their customers against the list. The FBI 
admitted it had no way to remove innocent 
people from the list, because its distribution 
had spun beyond its control. No one knows 
how many innocent people have been 
denied jobs or suffered other harm because 
of the list. 73 

• Two giant health insurance companies, 
Blue Cross-Blue Shield of Michigan and 
Aetna, conducted a search through mil- 
lions of customers' health insurance 
records for terrorists (none were found). 
The search of 6 million Michigan records 
by Blue Cross yielded 6,000 false posi- 
tives, all of whom were "investigated fur- 
ther" by the company's employees. Aetna, 
which searched through 13 million records 
across the nation, refused to say how many 
false positives its search generated or how 
they were handled. 74 

• The government's "no-fly" lists of terrorist 
suspects have ensnared hundreds of inno- 
cent Americans who find themselves fac- 
ing intense security scrutiny every time 
they try to fly, yet have no way of finding 
out how they got on a list, and no practical 
way to have their names removed. 75 
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As such stories demonstrate, there are numerous 
problems with the government's watch lists: 

• Lack of due process. Despite the bad 
effects that can accrue to those placed on 
such a list, there are no due process proce- 
dures that apply to those who are blacklist- 
ed, such as a right of appeal or a right to see 
the information upon which a listing is 
based. This violates the core American 
principle that no one should be punished 
without due process. 

• Slanted incentives. There may well be 
strong bureaucratic incentives within the 
security agencies to place names on watch 
lists, and strong disincentives to remove 
names. After all, who would want to be 
the person responsible for removing or 
failing to add a name that later turned out 
to belong to a terrorist? 76 

• Bloated lists. Consistent with that 
dynamic, the U.S. government's watch 
lists appear to be ridiculously bloated; 
news reports have put the number of 
names in the millions. 77 That suggests it 
will become increasingly common for 
someone to be flagged based on such 
lists (especially when the inevitable 
cases of mistaken identification are 
added to the equation). 

• Private piggybacking. There are no lim- 
its on the private uses or abuses of such 
lists, which are increasingly being used by 
landlords and even car dealers. 78 

An entire archipelago of government-enforced 
watch lists has been created haphazardly and 
without the carefully constructed checks and bal- 
ances that such a powerful instrument demands. 
And now that system is being plugged in to the 
private sector, where a million eyes can watch 
for the millions of people on these lists. 
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Background checks: from reporting 
to enforcement 

Watch list requirements are actually qualita- 
tively different from other forms of out- 
sourced surveillance. While many programs 
have increased the information flowing 

A massive new infrastructure for every- 
day background checks in American life 
is being built. 

inward to the government, watch lists are a 
mechanism by which the government sends 
information outward into society. That serves 
two purposes: 

• It alerts the government's information-col- 
lection networks to search for particular 
kinds of information, thereby increasing the 
power of the distributed surveillance system. 

• It turns companies into sheriff's deputies, 
responsible not just for feeding informa- 
tion to the government, but for actually 
enforcing the government's wishes, for 
example by effectively blacklisting any- 
one who has been labeled as a suspect 
under the government's less-than-rigorous 
procedures for identifying risks. 

A similar explosion of distributed enforce- 
ment/surveillance is taking place through the 
construction of a massive new infrastructure for 
everyday background checks in American life: 

• Off-the-shelf software for conducting 
background checks is now being sold at 
Wal-Mart-owned "Sam's Club" stores for 
around $40. The software allows even the 
smallest business to carry out various 
checks by accessing databases compiled 
by the data aggregator Choicepoint. 79 



• Congress passed legislation called the PRO- 
TECT Act, which created a pilot program for 
FBI background checks on people who 
donate their time to various volunteer organ- 
izations. The FBI estimates that 26 million 
Americans a year could be required to be fin- 
gerprinted under this program. The criteria 
for failing one of these checks include the 
commission of any felony, or a misdemeanor 
involving controlled substances. 80 

• The Patriot Act required institution of 
checks on truck drivers with Hazmat 
licenses, 81 so the government is gearing up 
to do 3.5 million criminal background 
checks (which may actually be conducted 
by a private contractor such as Lockheed 
Martin). In a perfect example of public- 
private synergy, employers in the trucking 
industry may begin requiring all their driv- 
ers to get Hazmat licenses so they can get 
background checks on their drivers, whom 
they often don't trust. 

• A growing normalization of background 
checks by employers of all kinds is emerg- 
ing. One survey found 80 percent of com- 
panies now conduct background checks on 
job candidates. 82 

• The FBI's new Terrorist Screening Center 
plans to allow private-sector entities "such 
as operators of critical infrastructure facili- 
ties or organizers of large events" to submit 
lists of names to the government to be 
checked for "any nexus to terrorism." 83 

These checks are one of the fastest-growing 
areas of integration between the 
surveillance/enforcement functions of govern- 
ment and the private sector. There may well be 
good reasons for implementing background 
checks in certain circumstances, but an entire 
infrastructure for such checks is being con- 
structed, and in the long run, there are few 
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areas of our lives that will be untouched. Few 
are stopping to ask what the consequences will 
be of, for example, banning people from driv- 
ing a truck or volunteering in sports organiza- 
tions because they have been busted for pos- 
session of marijuana, had a credit problem (real 
or erroneous) or angered a former landlord. 

Enlistment in the government's 
surveillance web hurts business 

The government has forced businesses to hire 
new staff and assume other expensive burdens to 
help conduct its surveillance. A wide variety of 
businesses, including even pawn shops, are faced 
with the prospect of setting up employee training 
programs, hiring compliance officers, creating 
written procedures, conducting annual "inde- 
pendent audits" or creating "customer identifica- 
tion programs." 84 Bank of America, for example, 
had to create a new department with six employ- 
ees to handle the government's new surveillance 
mandates. 85 BellSouth employs a team of 16 
full-time workers for the same purpose. 86 The 
brokerage industry alone will have to spend up to 
an estimated $700 million in the next few years 
complying with the Patriot Act. 87 

All these employees are, in effect, "outsourced" 
extensions of the government's growing sur- 
veillance machine, and these expenditures are 
hidden taxes that corporations often pass on to 
customers in the form of higher costs and fees. 

Even worse for some companies is the fact that 
sweeping laws expanding government access 
to information could endanger overseas busi- 
ness deals. Canadians have recently expressed 
concern that because of the Patriot Act, their 
personal information could be placed in the 
hands of the FBI if contracts to perform out- 
sourced functions for the Canadian govern- 
ment are given to U.S. companies. 88 



An ACLU Report 

Failure to comply with the government's new 
mandates can also entail more direct costs; 
already one company, Western Union, has been 
fined $8 million under the Patriot Act for failing 
to report multiple "suspicious" transactions. 89 

The costs of airline passenger profiling 

Perhaps the biggest example of burdensome 
surveillance mandates is the standardization 
of airline reservations and identity data that 
would be required by CAPPS II or other pas- 
senger-profiling schemes. The independent 
contractors that handle reservations for most 
airlines and the other computer systems to 
which they connect, from Web sites to travel 
agencies, are simply not equipped to routine- 
ly collect names, addresses and telephone 
numbers for all travelers. Many people travel 

Sweeping taws expanding government 
access to information coutd endanger 
overseas business deats. 

under group reservations, for example, in 
which a block of seats is reserved under just 
one name. And there is not even a field for 
date of birth in the existing databases - and it 
is no simple matter to add one. 

The cost of rebuilding these interlocking systems 
to airlines, travel agents and the traveling public 
would be enormous; no systematic study has 
been done, not even by the government, but for 
CAPPS II, travel writer Edward Hasbrouck has 
estimated the cost at $1 billion, 90 and the 
International Air Transport Association reported 
estimates of more than $2 billion. 91 The TSA has 
never explained who will bear this expense or 
even sought to detail it. And of course that expen- 
diture is only the beginning; there is also the cost 
to travelers in new hassles and frustrations. 92 The 
Association of Corporate Travel Executives testi- 
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Terrorist investiga- 
tions in a box 



Homeland Tracker 5.5 
OFAC Tracker 5.5 
World Tracker 5.5 




Windows® Manual 



An entire 
industry has 
sprung up to 
produce 
software 
that makes it 
easier for 
companies 
to enforce 
the govern- 
m e n t ' s 
blacklists and other mandates. An 
example is "Homeland Tracker," pro- 
duced by a subsidiary of the giant data- 
base company Choicepoint to "help any 
business comply with OFAC and USA 
PATRIOT Act regulations." The manual 
proudly touts the software's ability to 
"get identity verification, check individ- 
ual names, scan customer files" and 
"build personal accept and deny lists" 
(otherwise known as blacklists). Once 
a company's customer data is 
"scanned for violations against all data 
lists" - that is, government watch lists 
- the software lets the company "scan, 
block or reject business transactions" 
involving any entities "that threaten 
national security." 93 



This kind of product is offered by 
more than 50 companies and is being 
used, according to one survey, by 83 
percent of financial companies for 
watch list screening, and by 50 per- 
cent to analyze transactions for 
money-laundering violations. 94 



fied that a "conservative estimate" of the cost of 
CAPPS II to business in delays and denied board- 
ings would be $2 billion. 95 

By assuming the expenses of hiring workers, 
building new systems and procedures and pur- 
chasing software, businesses are helping to 
finance the creation of a legal and technological 
infrastructure for the systematic surveillance of 
individuals through their private-sector transac- 
tions. The government has always enlisted the 
help of citizens and others in fighting criminals, 
through such devices as "most wanted" posters. 
But that relatively simple device is worlds away 
from the wholesale recruitment of private cor- 
porations as extensions of the government's 
mass information-collecting apparatus. 



Mass Data Use, Public 
and Private 

Ultimately, the U.S. may need huge databases 
of commercial transactions that cover the 
world or certain areas outside the U.S.... 
Acxiom could build this mega-scale database. 
- Doug Dyer of the Pentagon's Total 
Information Awareness program 96 

As we have seen, the government is recruiting 
both individuals and corporations into an 
emerging surveillance system. TIPS-like pro- 
grams aim to promote and organize individu- 
als' vigilance over each other, and feed the out- 
put of that mutual observation to the govern- 
ment. And, by plugging into the growing tor- 
rents of data swirling through private-sector 
computers, security agencies are doing the 
same thing with corporations: turning them 
into bigger, more far-reaching versions of the 
cable guy, able to inform on millions of cus- 
tomers in a single bound. 
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But the progression toward a surveillance 
society involves much more than efforts to 
gather information from particular organi- 
zations or even particular industries. It 
also includes efforts at the mass aggrega- 
tion of information about individuals that 
aim to do for the rest of American life what 
the Patriot Act is already doing for the 
financial sector. If allowed to go far 
enough, this trend would turn America into 
a truly Orwellian society. 

Data mining 

A primary motivation for and justification of 
mass data gathering about Americans is a 
group of techniques loosely labeled "data 
mining." The idea behind data mining is to 
tap into the ever-growing number of databas- 
es containing details on individuals' behav- 
ior, aggregate that data to form rich pictures 
of individuals' activities and then use com- 
puter models to scrutinize them en masse for 
suspicious behavior. 

Interest in this concept within the govern- 
ment has sharply raised the stakes of gov- 
ernment access to third-party data, 
because it takes scattered, disconnected 
databases that may be relatively harmless 
in isolation and transforms them into a 
means for the government to monitor 
individuals' activities. 

While data mining has never been validated 
as a method for catching terrorists, it has 
been pursued by numerous government 
agencies, from the Army to NASA. The most 
notorious example is the Pentagon's now- 
defunct "Total Information Awareness" pro- 
gram, which sought to use data mining to 
help identify terrorists from among the hun- 
dreds of millions of innocent individuals in 
the United States. 



From the start, TIA was premised on a tight- 
ly interlinked relationship between govern- 
ment and private-sector data companies. 
Program director John Poindexter of the 
Defense Advanced Research Projects Agency 
(DARPA) explained that the goal was to mine 
"the transaction space" in order to find "sig- 

Interest in this concept within the 
government has sharply raised the stakes 
of government access to third-party data. 

natures" of terrorist activity. A graphic on the 
TIA Web site listed the types of databases 
that would make up this "transaction space," 
including financial, medical, travel, 
"place/event entry," transportation, housing 
and communications. 

Private companies, of course, hold much of 
the data in these categories, and in order to 
achieve Poindexter 's stated goal of weaving 
these databases together so that they can be 
treated "as if they were one centralized 
database," the government would clearly 
need to secure access to vast stores of private- 
sector data. 
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Total Information Awareness: far 
from unique 

Congress ultimately voted to strip the funding from 
Poindexter's program. But TIA was hardly unique. 
Another program intended to aggregate and analyze 
vast amounts of private-sector information on the 
activities of Americans is the MATRIX, which 
stands for "Multi-State Antiterrorism Information 
Exchange." Like TIA, this program is based on 
bringing together vast amounts of information to 
detect terrorism and other crimes, except the 
MATRIX is run at the state level, and combines 

Parts of the originat TIA program live on 
in the Pentagon's secret "black budget." 

government databases from participating states with 
a private database that claims to have "20+ billion 
records from 100's of sources." 97 

At one time 16 states had agreed to participate 
in the MATRIX. But as a result of the public 
light thrown on the program by the media and 
by freedom of information requests filed by the 
ACLU, at least two-thirds of its members 
dropped out as of March 2004. 98 

The program continues, and in a move that is 
typical of the industry, Seisint is being pur- 
chased by LexisNexis, a giant data company, 
raising the prospect that even more torrents of 
information will be fed into the program." 

Other government data mining projects are 
also afoot: 

• The NSA has a program called "Novel 
Intelligence From Massive Data," about 
which little is known. 100 

• The CIA reportedly is using a data-min- 
ing program called Quantum Leap that 



"enables an analyst to get quick access to 
all the information available - classified 
and unclassified - about virtually any- 
one." (The CIA's deputy chief informa- 
tion officer told a reporter that the tech- 
nology is "so powerful it's scary" and 
"could be Big Brother.") 101 

• Parts of the original TIA program live on 
in the Pentagon's secret "black budget." 

• A May 2004 survey of federal govern- 
ment data-mining efforts by the General 
Accounting Office revealed at least four 
data-mining programs that use personal 
information from private-sector databas- 
es in the hunt for terrorists. For exam- 
ple, the GAO identified a program run 
by the Defense Intelligence Agency that 
mines data "to identify foreign terrorists 
or U.S. citizens connected to foreign ter- 
rorism activities." 102 

Regardless of the activities of any particular 
government agency, it is clear that because 
of data mining, and the data aggregation that 

Data aggregators are operating in a 
world where their work is becoming 
increasingly frightening and 
politically charged. 

it depends upon, the compilation and shar- 
ing of information gathered by the private 
sector has assumed a much greater impor- 
tance than in the past. It raises the prospect 
that information collected by one's broker, 
supermarket or catalog retailer will become 
data points in a frighteningly complete 
dossier, scrutinized by suspicious govern- 
ment security agencies. 



24 



An ACLU Report 



Data aggregators 

Government agencies are not the only organi- 
zations that are interested in creating high-res- 
olution pictures of individuals' activities by 
drawing together data from a variety of 
sources. Companies called "data aggregators" 
do the same thing for profit. These companies, 
which include Acxiom, Choicepoint, Lexis- 
Nexis and many others, are largely invisible to 
the average person, but make up an enormous, 
multi-billion-dollar industry. The Privacy Act 
of 1974 banned the government from main- 
taining information on citizens who are not the 
targets of investigations - but law enforcement 
agencies are increasingly circumventing that 
requirement by simply purchasing information 
that has been collected by data aggregators. 103 

Originally fueled by the economic drive to 
make expensive corporate marketing cam- 
paigns more efficient, these companies are 
operating in a world where their work is 
becoming increasingly frightening and politi- 
cally charged - in part because of the new 
post 9/11 environment and the government's 
corresponding hunger to gather as much data 
as it can, and in part because of their very suc- 
cess in gathering more and more information 
about everyone. 

Data companies collect information from court- 
houses and other public sources, as well as mar- 
keting data - sometimes including extremely 
personal information, such as lists of individuals 
suffering from incontinence, prostate problems 
and clinical depression. 104 Some databases are 
even co-ops in which companies agree to con- 
tribute data about their own customers in return 
for the ability to pull out rich profiles of their 
customers based on the data contributed by all 
members. Once such company, Abacus Direct, 
for example, boasts to prospective members that 
their data will be "combined with other 1 ,700+ 



How data mining is 
used: a snapshot 

The amount of information that is 
available about a person once you 
have his or her name and address is 
stunning. A marketing brochure 
published by the data company and 
credit rating giant Experian provides 
a snapshot of the kind of practices 
that have become common. 

The brochure describes how 
Experian helped the electronics 
retailer Best Buy "develop a 360- 
degree view of their customers." 
Having gathered basic information 
about its customers from "19 cus- 
tomer touch-points," Best Buy 
"enhanced over 50 million cus- 
tomer records" with data compiled 
by Experian. That data came from 
"more than 3,500 public and pro- 
prietary data sources," and 
includes age, estimated income, 
occupation, "lifestyle data" and 
data about individual's product 
purchases "such as PC ownership 
and others." 105 

It is unclear whether Experian was 
allowed to keep the purchase 
records of Best Buy's customers 
as part of this deal. It is clear, 
however, that many companies are 
betraying their customers by 
sharing the details of their trans- 
actions with data companies that 
add them to the dossiers they 
maintain about us. 
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companies' transactions," that "Consumer buy- 
ing behavior [is] defined for over 90 million 
households (90 percent of U.S.)," that they have 
records of 3.5 billion transactions and that - lest 
any corporate members fret over betraying the 
details of their customers' activities - "It's a 
confidential alliance." 106 

Government customers 

As we have seen, all the information gath- 
ered by these companies is now easily avail- 
able to government security agencies - 
whether through the many legal tools avail- 
able to them for seizing personal information 
held by third parties like Experian, or by 



One of the biggest data aggregators 
claims to have contracts with at 
least 35 government agencies. 



data; companies are actually creating and reshap- 
ing their products to meet the needs of govern- 
ment security agencies. 109 The fact is, private 
companies are increasingly moving in to perform 
functions that used to be carried out by the police. 

Data companies provide information and 
services that include financial reports, edu- 
cation, professional credential and reference 
verification, felony checks, motor vehicle 
records, asset location services, and informa- 
tion on an individual's neighbors and family 
members, as well as the "location of witness- 
es, suspects, informants, criminals, [and] 
parolees" and the "verification of identity in 
criminal and civil investigations" and in 
"national security matters." 110 Tens of thou- 
sands of federal law enforcement agents 
have access to these services, with few safe- 
guards against abuse. 111 

Not just federal agencies but also many local 
police departments subscribe to private-sector 
information services that can provide officers 
with information - such as a list of a person's 
past roommates - that would spark outrage if 
maintained directly by the police in their own 
files. In the newest twist, officers on the beat 
are even being given the power to access this 
kind of data on the fly using handheld wire- 
less devices. 112 

Just as 19th century commercial file-keep- 
ing techniques began as a means of deter- 
mining creditworthiness, and then were used 
to keep tabs on "Reds" and labor agitators, 113 
so we are now witnessing the transmogrifi- 
cation of commercial databanks originally 
created for commercial purposes into securi- 
ty tools. And although these new tools are 
extremely powerful, they are constrained by 
few legal, procedural or technological safe- 
guards against abuse. 



simply buying it. And the government is, in 
fact, buying information from these compa- 
nies. One of the biggest data aggregators, 
for example, Choicepoint, claims to have 
contracts with at least 35 government agen- 
cies. It has an $8 million contract with the 
Justice Department that allows FBI agents to 
tap into the company's vast database of per- 
sonal information on individuals, as well as 
contracts with the Drug Enforcement 
Administration, the U.S. Marshals Service, 
the IRS, the Bureau of Citizenship and 
Immigration Services (formerly INS) and the 
Bureau of Alcohol, Tobacco and 
Firearms. 107 Another data aggregator, Seisint 
Inc., has received more than $9.2 million in 
grant money from the Department of Justice 
and the Department of Homeland Security to 
provide commercial data to the MATRIX 
program. 108 

The government is not just dipping into a pre- 
existing commercial marketplace to purchase 
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The advantages of private 
surveillance 

The use of private-sector data aggregators 
allows the government to insulate surveillance 
and information-handling practices from priva- 
cy laws or public scrutiny. That is sometimes 
an important motivation in outsourced surveil- 
lance. Private companies are free not only 
from complying with the Privacy Act, but from 
other checks and balances, such as the 
Freedom of Information Act. They are also 
insulated from oversight by Congress and are 
not subject to civil-service laws designed to 
ensure that government policymakers are not 
influenced by partisan politics; unlike federal 
government workers, private employees can 
make donations to political campaigns. 114 

Other examples of government officials nurtur- 
ing surveillance schemes that rest in private 
hands include: 

• Minnesota's "Multiple Jurisdictional 
Network Organization." In a case reminis- 
cent of the mid-20fh century private file- 
keeping groups, it emerged in 2003 that a 
private group, the Minnesota Chiefs of 
Police Association, was allowing the police 
to search its database of law enforcement 
case files from around the state. Raw case 
files contain not just criminal record infor- 
mation, but records of any interaction with 
the police, whether as victim, witness, gun- 
permit applicant or even the subject of an 
accusation by a disgruntled neighbor or 
coworker. The database has been shut down 
repeatedly because of privacy and security 
concerns, but may return as a purely state- 
owned and operated system. 115 

• Image Data's "TruelD" system. The 

Secret Service provided technical assis- 
tance and nearly $1.5 million in federal 



funds to a company attempting to compile a 
national database of driver's license photo- 
graphs and make them available for securi- 
ty and commercial purposes. Under the 
scheme, individuals' photographs would 
pop up when they appeared at security 
checkpoints or used a credit card. The plan, 
which amounted to a privatized national ID 
system that security agencies would never 
have dared propose directly, collapsed after 
it provoked a public outcry. 116 



Pro-Surveillance 
Lobbying 

In 20 years, do you think the global database 
is going to exist, and will it be run by Oracle? ' 
I asked. 'I do think it will exist, and I think it is 
going to be an Oracle database,' he replied. 
'And we 're going to track everything! 
- Jeffrey Rosen interview with Oracle CEO 
Larry Ellison 117 

As we have seen, there are many ways in which 
the government is pressuring corporations to do 
surveillance on its behalf. But the reverse is also 

Airport officials were receiving pitches 
from security technology companies 
within days of the 9/11 attacks. 

true: Some corporations are pressuring the gov- 
ernment to invest in surveillance. 

Surveillance is big business. Because of the 
explosion of computers, database technology 
and information gathering, surveillance tech- 
nologies are emerging as one of the ripest 
plums for companies to pluck in the new 
"anti-terrorism biz." E-mails obtained by the 
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ACLU (as part of its effort to monitor face- 
recognition technology) show that airport 
officials were receiving pitches from securi- 
ty technology companies within days of the 
9/11 attacks. 118 

Enormous sums of money are being poured 
into government research and development on 
anti-terror initiatives - an estimated $115 bil- 
lion in 2003 alone, rising to an estimated $130 
billion to $180 billion a year through 2010. 119 
And many companies want a piece of that 
action. Examples include: 

• Lockheed Martin. The defense giant has 
received a five-year, $12.8 million contract 
to work on the CAPPS II airline profiling 

Defense contractors are turning their 
focus inward to applications involving 
surveillance within the nation's borders. 

system. It also works on identification 
systems with the FBI and others and was a 
major recipient of contracts by 
Poindexter's office at DARPA. 120 

• Acxiom. The Arkansas data aggregator paid 
Gen. Wesley Clark $830,000 to help it obtain 
post-9/11 contracts. Clark lobbied Treasury 
Secretary Paul O'Neill and aides to FBI 
Director Robert Mueller, and even met per- 
sonally with Vice President Dick Cheney. 121 

• Choicepoint. The Georgia data company 
increased its lobbying expenditures four- 
fold after 9/11, from $100,000 in 2000 to 
more than $400,000 in 2002. 122 

These companies are hardly alone; one 2003 
study found that 569 companies had registered a 
homeland security lobbyist. As one lobbyist told 
The New York Times, "the major defense contrac- 
tors want to move into the homeland security 



arena in a big way." 123 And often that means 
turning their focus inward from the development 
of fighter jets and other weapons designed for 
overseas combat to applications involving sur- 
veillance within the nation's borders. 

It is not possible to determine the overall extent to 
which private-sector lobbying has actually driven 
the government's push for increased surveillance, 
as opposed to simply helping companies fight for 
pieces of a pre-determined government pie. It 
will be up to historians and investigative reporters 
to measure the role of companies pushing new 
software products, or seeking to develop a home- 
land security market for their pre-existing data 
stores. But in at least some cases, major new 
impetus for surveillance-friendly policies has 
clearly come from the private sector: 

• TIA. The Pentagon's TIA program was 
proposed by a private company, an engi- 
neering services firm called Syntek. 
Syntek vice president John Poindexter 
worked on components of TIA for years 
before eventually becoming director of the 
DARPA's Information Awareness Office, 
which oversaw the program. 124 

• The MATRIX. The interstate MATRIX pro- 
gram similarly originated with a private com- 
pany, the data aggregator Seisint. In 2001, the 
company's founder approached Florida 
police with the idea, and Seisint began devel- 
oping the program for Florida, which was 
later joined by other interested states. 125 

• National ID Cards. Larry Ellison, the 
CEO of Oracle Software, almost single- 
handedly created a national debate over 
the notion of a U.S. national identity card 
in late 2001 by calling for such a card and 
promising to provide the software for it 
without charge. Critics noted that he did 
not agree to pay for the far more lucrative 
servicing contracts on the system. 126 
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• Face Recognition. In the wake of 9/11, 
vendors of face-recognition software 
began to aggressively tout their product 
as a "nationwide shield" that would pre- 
vent future attacks, leading to the exper- 
imental deployment of the technology in 
airports around the nation. (Most quick- 
ly concluded that the technology was not 
up to the task.) 127 



Insufficient powers of surveillance was not 
America's problem on 9/11; a congressional 
investigation into the attacks as well as 
reports issued by the National Commission 
On Terrorist Attacks Upon The United 
States (the "9/11 Commission") found 
that the government's failure to prevent 

The power of government and the 
power of corporations, instead of being 
set against each other, are actuatty 
becoming aligned. 

them was a result of fundamental organiza- 
tional breakdowns in the intelligence com- 
munity, and the government's failure to 
make effective use of the surveillance pow- 
ers it already had. 128 But there is much more 
money to be made providing complex, cut- 
ting-edge technological solutions to securi- 
ty problems than there is in sorting out 
organizational or bureaucratic problems, or 
fixing problems with the basics of security 
by, for example, strengthening airplane 
cockpit doors or increasing the profession- 
alism of airport security screeners. 

It would be a double tragedy if the emerging sur- 
veillance-industrial complex were not only to 
lobby for increased surveillance on Americans, 
but also to divert resources from security meas- 
ures that would be far more likely to be effective 
in protecting Americans from attacks. 



Six Conclusions 



We should take nothing for granted. 
- President Eisenhower 

Conclusion #1: An alliance of 
unchecked interests 

Individual freedom is always at risk in the face 
of large, powerful institutions. In America, this 
problem has been addressed by setting power 
against power. In the case of government 
power, that has been accomplished through the 
system of checks and balances put in place in 
our Constitution. In the case of corporate 
power, that has been accomplished through 
competition, which sets company against com- 
pany, and through regulation, which sets the 
power of government against the power of cor- 
porations (including the government's antitrust 
powers, to ensure that company remains set 
against company). 

In the area of privacy, however, these time-test- 
ed protective arrangements are increasingly 
breaking down: 

• Insufficient and eroding checks on gov- 
ernment. The checks and balances that are 
supposed to restrain government power 
are not being put in place, as shown by the 
lack of due process protections for watch 
lists, for example, or rules to handle data 
collected from citizen tip lines. Often, this 
is because of the rapidity with which new 
information technologies have emerged - 
but existing checks and balances are also 
being weakened, such as judicial oversight 
of surveillance, which was reduced 
sharply by the Patriot Act. 

• Insufficient checks on corporations. 

The virtual absence of governmental reg- 
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ulation of corporate privacy in the U.S. - 
unique in the developed world - gives 
companies a free hand to sell, trade and 
share the details of their customers' trans- 
actions without their permission or 
knowledge. And while competitive 

Sifting through the lives of hundreds of 
miltions of people is an inefficient, highly 
unreliable means of discovering a 
one-in-a-billion terrorist. 

forces may limit data sharing among 
some companies, the thriving market- 
place of data brokers often serves the 
function of bridging that gap. 

The power of government and the power of corpo- 
rations, instead of being set against each other, are 
actually becoming aligned. There are certainly 
companies and industries concerned about privacy, 
and others concerned about the costs of complying 
with the new surveillance mandates. But most 
companies have a strong incentive to maximize 
consumer data collection, and even the most priva- 
cy-protective company is helpless in the face of 
official demands for customer information. Other 
companies, as we have seen, actively lobby for 
wider government use of personal records. 

The United States has experienced occasional 
periods of intense social and political conflict, 
such as the Vietnam War, the Civil Rights move- 
ment and the labor movement earlier in the 20th 

The kinds of activities and information that 
the Founding Fathers sought to protect 
through the Fourth Amendment have 
moved out of the home in modern life. 

century. Given the greatly enhanced surveillance 
powers of major corporations and government 
security agencies, which in the past have active- 



ly opposed such movements, how will the forces 
fighting for change fare today and the next time 
such a period emerges? 

Conclusion #2: Mass surveil- 
lance threatens freedom more 
than it threatens terrorists 

The government's post-9/11 efforts to vacuum up 
and sift through masses of private-sector data is 
premised on the impulse that "if we had just 
known who those people were and what they 
were doing, we could have stopped them - so let's 
track everyone." The tragedy is that mass sur- 
veillance is not only dangerous to our liberties, 
but is unlikely to be effective. Sifting through the 
lives of hundreds of millions of people is an inef- 
ficient, highly unreliable means of discovering a 
one-in-a-billion terrorist. The best way to stop 
terrorism is still through old-fashioned intelli- 
gence and law enforcement techniques that rely 
on working outward from known leads and sus- 
pects. Attempting to work inward from the entire 
resident and visitor population of the United 
States to locate a handful of terrorists will harm 
many innocent people yet leave us vulnerable. 

Working outward from known leads is not only 
more effective, but is also compatible with an 
entire body of law that has grown up over hun- 
dreds of years to prevent abuses by all-too-human 
investigators. The drive to detect wrongdoing 
through the mass scrutiny of individual records 
from the private sector, on the other hand, would 
violate a principle that is core to our legal system: 
The government cannot invade your privacy 
unless it has individualized reason to believe that 
you are involved in wrongdoing. The principle of 
individualized suspicion not only protects individ- 
uals against unfair treatment, but also imposes a 
necessary discipline on police investigators, who 
can be tempted at times to engage in wasteful and 
inefficient fishing expeditions. Unfortunately, as 
this report demonstrates, the fishing expedition 
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approach is rapidly being hardwired into our laws 
and even our technologies. 

Conclusion #3: The courts must 
catch up 

Historically, the courts have been slow to adapt 
the Fourth Amendment 12 '' to new technology, 
and today is no different. When the telephone 
came into use, the Supreme Court failed to give 
legal protection to the content of telephone con- 
versations against government wiretapping, 
instead engaging in literal-minded hairsplitting 
about whether particular eavesdropping devices 
physically penetrated a "constitutionally pro- 
tected area." It was almost 40 years before the 
Supreme Court finally ruled that a wiretap, just 
like a physical search, required a warrant based 
on probable cause, and that "the Fourth 
Amendment protects people, not places." 130 

Today, the Supreme Court has still not recog- 
nized the right to privacy in highly personal 
information held by third parties - whether 
financial records, medical records or library and 
book records - on the theory that there can be no 
"reasonable expectation" of privacy regarding 
such information. When the Constitution was 
written, the home was the center of economic, 
financial and even medical life, and personal 
records and writings were likely to be stored 
there, not on the servers of a multinational cor- 
poration. The Founders therefore created strong 
protections for people's "houses and effects." 

Today our homes remain highly protected from 
government scrutiny, but the kinds of activities and 
information that the Founding Fathers sought to 
protect through the Fourth Amendment have 
moved outward due to computers, telecommunica- 
tions and other developments of modem life. But 
though privacy in one's affairs is no less necessary 
today, we are now exposed to easy scrutiny by the 
government and other powerful institutions. 



As with phone calls last century, so with third-party 
records today: The Court has yet to transcend the 
particular, 1 8th century formulation of privacy writ- 
ten into the Constitution and embrace the deeper 
ethos of privacy that the Founders intended to pro- 
tect, and that is necessary to preserving a healthy 
democracy in an age of high technology. 

Our laws will probably catch up, as they did with 
the telephone, but we must ensure that they are 
given the chance. It is a very real danger that, given 
the time it takes the courts to adjust to new technol- 
ogy, our law enforcement and national security 
establishments will take advantage of the lag to 
institutionalize data mining and other surveillance 
practices that would never be accepted otherwise. 

Conclusion #4: The ACLU is 
leading the fight 

The ACLU is working hard across many of the 
dimensions described in this report to combat 
the emergence of a public-private surveillance 
state. In the past two years, the ACLU: 

• Helped defeat TIPS. The ACLU led pub- 
lic opposition to this intrusive proposal, 
both in the media and in the halls of 
Congress. (See www.aclu.org/SafeandFree/ 
SafeandFree.cfm?ID=11295&c=206). 

• Helped defeat TIA. The ACLU was 
instrumental in creating and maintaining 
public pressure on this program, leading 
to its eventual defeat by Congress. (See 
www. aclu. org/Privacy/Privacy. cfm?ID= 
14729&c=130). 

Today the fight continues. The ACLU is: 

• Fighting against racial profiling. Abroad 
assault on the kind of racial profiling 
implicitly encouraged by TIPS-like "terror- 
ism watch" programs has been one of the 



31 



THE SURVEILLANCE-INDUSTRIAL COMPLEX 



ACLU's highest priorities both before and 
after 9/11. (See www.aclu.org/profiling). 

• Fighting the MATRIX. By coordinating 
action among the ACLU's state affiliates, 
including the filing of state open-records 
requests and efforts to inform state legislators 
about the program, the ACLU has helped 
reduce the number of participating states by 
two-thirds. (See www.aclu.org/matrix). 

• Fighting CAPPS II. From media appear- 
ances to public testimony to generating 
citizen faxes to lobbying in the halls of 
Congress and the European Union head- 
quarters in Brussels, the ACLU has helped 
point out the flaws of this unnecessary 
program and, so far, delay its deployment. 
(See www.aclu.org/capps). 

• Working to discover how the govern- 
ment's secret watch lists operate. The 

ACLU has filed a lawsuit to force the gov- 
ernment to comply with a Freedom of 
Information Act (FOIA) request seeking 
information on how the government's No- 
Fly list operates and how individuals can get 
off it. (See www.aclu.org/SafeandFree/ 
SafeandFree.cfm?ID=15422&c=206). 

• Challenging the No-Fly list in court. In 

addition to seeking information, the 
ACLU has also directly challenged the 
No-Fly list through a class action lawsuit 
filed on behalf of innocent people caught 
up by the list. (See www.aclu.org/nofly). 

• Fighting in court to find out how the 
Patriot Act is being implemented. 

The ACLU has filed a lawsuit to force the 
government to comply with a FOIA 
request for information on how often it has 
used the Patriot Act to obtain individuals' 
records from businesses or other third par- 
ties. (See www.aclu.org/patriotfoia). 



• Challenging the Patriot Act's "business 
records" section in court. The ACLU has 
launched a direct legal challenge to 
Section 215 of the Patriot Act, which 
greatly expands the government's ability 
to secretly obtain data held by libraries, 
businesses and other third parties. (See 
www.aclu.org/section215). 

• Challenging the use of "National Security 
Letters" in court. The ACLU has also filed 
a direct legal challenge to the Patriot Act's 
dramatic expansion of law enforcement's 
authority to use National Security Letters to 
demand customer records without judicial 
oversight. (See www.aclu.org/nsl). 

• Working in Congress to reverse the worst 
provisions of the Patriot Act. ACLU lob- 
byists have been working in Congress to 
pass legislation called the SAFE Act. (See 
www. aclu. org/S afeandFree/SafeandFree . cf 
m?ID=15962&c=206). 

• Running a national grassroots campaign 
to build opposition to Patriot Act surveil- 
lance. With a full-time team of community 
organizers, the ACLU has helped hundreds 
of communities, representing nearly 20% of 
the U.S. population, to pass resolutions in 
opposition to the Patriot Act. (See 
www. aclu. org/resolutions) . 

• Exposing government and private-sec- 
tor surveillance. The ACLU has pro- 
duced numerous reports to inform the pub- 
lic and the news media about government 
surveillance. They include: 

• "Bigger Monster, Weaker Chains: The 
Growth of an American Surveillance 
Society" (www.aclu.org/monster) 

• "Unpatriotic Acts: The FBI's Power to 
Rifle Through Your Records and 



32 



Personal Belongings Without Telling 
You" (www.aclu.org/SafeandFree/ 
SafeandFree.cfm?ID=13246&c=206) 

• "The Dangers of Domestic Spying by 
Federal Law Enforcement: A Case 
Study on FBI Surveillance of Martin 
Luther King" (www.aclu.org/Files/ 
OpenFile.cfm?id=9999). 

• Working to discover how information 
has been shared by airlines. The ACLU 
has filed FOIA requests with DHS and the 
TSA seeking information about how per- 
sonal travel information from JetBlue and 
American Airlines was shared and used. 
(See www.aclu.org/jetblue). 

• Fighting expansion of CALEA. The 

ACLU is working to prevent the expansion 
of CALEA, which would force Internet 
telephony companies to design their soft- 
ware to enable government eavesdropping. 
(See www.aclu.org/Privacy/ 
Privacy.cfm?ID=l 5468&c= 1 30). 

Conclusion #5: Individuals 
must act to stem the supply of 
personal data 

The government's strategy of relying on private- 
sector surrogates is a new and challenging devel- 
opment in the growth of surveillance. In the 
ACLU's view, the U.S. should emulate much of 
the rest of the developed world and create over- 
arching data privacy laws that cover at least our 
most sensitive data, including data in the hands 
of the private sector. The United States is virtu- 
ally alone among major industrialized nations in 
lacking such a law (or a federal privacy official 
charged with protecting the public). 

But regardless of one's opinions about how the 
government should regulate the commercial 
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sector, nearly everyone who cares about his or 
her personal privacy agrees that the govern- 
ment's use of the private sector to supply it 
with our personal information needs to be 
brought under control. One thing that con- 
sumers can do is to vote with their feet and 
their pocketbooks when they don't like what 
companies are doing behind their backs. In the 
short term, Americans must weigh in against 
the government's practice of "outsourcing sur- 
veillance" and make use of their role as con- 
sumers, shareholders and activists to put pres- 
sure on companies that are voluntarily partici- 
pating in this emerging system. 

The ACLU is creating a Web site to help indi- 
viduals contact companies about their privacy 
practices: www.aclu.org/privatize. 

Conclusion #6: We should take 
nothing for granted 

In his Farewell Address of January 17, 1961, 
President Eisenhower famously warned that the 
"conjunction of an immense military establish- 
ment and a large arms industry is new in the 
American experience." We might update his 
words to describe what we are facing today: 
"the conjunction of an immense security estab- 
lishment and a large data industry." 
Eisenhower's conclusion about what he dubbed 
the "military-industrial complex" was that: 

The potential for the disastrous rise of 
misplaced power exists and will per- 
sist. We must never let the weight of 
this combination endanger our liber- 
ties or democratic processes. We 
should take nothing for granted. 131 

This warning applies just as strongly to the "sur- 
veillance-industrial complex" that is emerging 
in our own time. And the consequences of 
ignoring it would be just as dire. 
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